Attackers are mass-distributing malware via legitimate but compromised websites using fake Cloudflare security verification pages. The malicious code, which mimics the “I’m not a robot” verification, targets Windows users.
Attackers are mass-distributing malware via legitimate but compromised websites using fake Cloudflare security verification pages. The malicious code, which mimics the “I’m not a robot” verification, targets Windows users.
The Government Computer Emergency Response Team of Ukraine (CERT-UA), operating under the State Special Communications Service, reported a new large-scale virus distribution campaign. According to the agency, in September 2026 alone, specialists recorded more than 100 compromised web resources to which hackers added malicious JavaScript code.
The attack, which is being carried out by a group with the identifier UAC-0277, uses the ClickFix technique. When navigating to a compromised site from search engines (e.g. Google, DuckDuckGo, or Ukrainian portals), the user is shown a fake security check. Instead of the usual click, the visitor is offered to copy and execute a certain command via the Run window (Win+R) or PowerShell.
CERT-UA emphasizes that no legitimate verification, including CAPTCHA or Cloudflare, ever requires the user to enter or execute system commands. If such requests appear, the page should be closed immediately.
To control the attack infrastructure, hackers use blockchain technology, in particular the Polygon and Ethereum networks, which allows them to quickly and discreetly change settings. By exploiting vulnerabilities in system drivers, the LUNEXSTEALER virus is downloaded to the victim's computer. It then installs a malicious extension in the browser disguised as Microsoft Office Word Editor, which completely steals logins, passwords, browser history and gives attackers remote access to the PC.
To secure IT infrastructure, system administrators are advised to block regular users from accessing the Run window and restrict the installation of programs without administrator rights. Such attacks using social engineering methods, when users are forced to manually run malicious code under the guise of updates or security checks, have become one of the most popular ways to bypass corporate antivirus systems in Ukrainian cyberspace in recent years.
